crosshair-tool 0.0.95__tar.gz → 0.0.96__tar.gz

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crosshair-tool
-Version: 0.0.95
+Version: 0.0.96
 Summary: Analyze Python code for correctness using symbolic execution.
 Home-page: https://github.com/pschanely/CrossHair
 Author: Phillip Schanely

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/__init__.py

@@ -15,7 +15,7 @@ from crosshair.statespace import StateSpace
 from crosshair.tracers import NoTracing, ResumedTracing
 from crosshair.util import IgnoreAttempt, debug
 
-__version__ = "0.0.95"  # Do not forget to update in setup.py!
+__version__ = "0.0.96"  # Do not forget to update in setup.py!
 __author__ = "Phillip Schanely"
 __license__ = "MIT"
 __status__ = "Alpha"

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/condition_parser_test.py

@@ -1,8 +1,6 @@
 import inspect
 import json
 import sys
-import textwrap
-import unittest
 from typing import List
 
 import pytest

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/core.py

@@ -377,7 +377,8 @@ def with_symbolic_self(symbolic_cls: Type, fn: Callable):
             elif any(isinstance(a, CrossHairValue) for a in args) or (
                 kwargs and any(isinstance(a, CrossHairValue) for a in kwargs.values())
             ):
-                self = symbolic_cls._smt_promote_literal(self)
+                # NOTE: _ch_create_from_literal is suppoerted for very few types right now
+                self = symbolic_cls._ch_create_from_literal(self)
                 target_fn = getattr(symbolic_cls, fn.__name__)
             else:
                 args = map(realize, args)

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/core_test.py

@@ -5,7 +5,6 @@ import re
 import sys
 import time
 from typing import *
-from unittest import skipIf
 
 import pytest  # type: ignore
 
@@ -736,7 +735,7 @@ def test_newtype() -> None:
     assert isinstance(x, SymbolicInt)
 
 
-@skipIf(sys.version_info < (3, 12), "type statements added in 3.12")
+@pytest.mark.skipif(sys.version_info < (3, 12), reason="type statements added in 3.12")
 def test_type_statement() -> None:
     env: dict[str, Any] = {}
     exec("type MyIntNew = int\n", env)
@@ -747,7 +746,7 @@ def test_type_statement() -> None:
     assert isinstance(x, SymbolicInt)
 
 
-@skipIf(sys.version_info < (3, 12), "type statements added in 3.12")
+@pytest.mark.skipif(sys.version_info < (3, 12), reason="type statements added in 3.12")
 def test_parameterized_type_statement() -> None:
     env: dict[str, Any] = {}
     exec("type Pair[A, B] = tuple[B, A]\n", env)

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/diff_behavior_test.py

@@ -1,5 +1,3 @@
-import sys
-import unittest
 from typing import Callable, List, Optional
 
 from crosshair.diff_behavior import (

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/builtinslib.py

@@ -346,7 +346,7 @@ class AtomicSymbolicValue(SymbolicValue):
         raise CrossHairInternal(f"_pytype not implemented in {cls}")
 
     @classmethod
-    def _smt_promote_literal(cls, val: object) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal: object) -> Optional[z3.ExprRef]:
         raise CrossHairInternal(f"_smt_promote_literal not implemented in {cls}")
 
     @classmethod
@@ -1120,7 +1120,7 @@ class SymbolicBool(SymbolicIntable, AtomicSymbolicValue):
         return bool
 
     @classmethod
-    def _smt_promote_literal(cls, literal) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal) -> Optional[z3.ExprRef]:
         if isinstance(literal, bool):
             return z3.BoolVal(literal)
         return None
@@ -1189,7 +1189,7 @@ class SymbolicInt(SymbolicIntable, AtomicSymbolicValue):
         return int
 
     @classmethod
-    def _smt_promote_literal(cls, literal) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal) -> Optional[z3.ExprRef]:
         if isinstance(literal, int):
             return z3IntVal(literal)
         return None
@@ -1410,7 +1410,7 @@ class PreciseIeeeSymbolicFloat(SymbolicFloat):
         return _PRECISE_IEEE_FLOAT_SORT
 
     @classmethod
-    def _smt_promote_literal(cls, literal) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal) -> Optional[z3.ExprRef]:
         if isinstance(literal, float):
             return z3.FPVal(literal, cls._ch_smt_sort())
         return None
@@ -1533,7 +1533,7 @@ class RealBasedSymbolicFloat(SymbolicFloat):
         return z3.RealSort()
 
     @classmethod
-    def _smt_promote_literal(cls, literal) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal) -> Optional[z3.ExprRef]:
         if isinstance(literal, float) and isfinite(literal):
             return z3.RealVal(literal)
         return None
@@ -2447,7 +2447,7 @@ class SymbolicType(AtomicSymbolicValue, SymbolicValue, Untracable):
         return type
 
     @classmethod
-    def _smt_promote_literal(cls, literal) -> Optional[z3.SortRef]:
+    def _smt_promote_literal(cls, literal) -> Optional[z3.ExprRef]:
         if isinstance(literal, type):
             return context_statespace().extra(SymbolicTypeRepository).get_type(literal)
         return None
@@ -2668,10 +2668,25 @@ class SymbolicCallable:
     __annotations__: dict = {}
 
     def __init__(self, values: list):
+        """
+        A function that will ignore its arguments and produce return values
+        from the list given.
+        If the given list is exhausted, the function will just repeatedly
+        return the final value in the list.
+
+        If `values` is concrete, it must be non-mepty.
+        If `values` is a symbolic list, it will be forced to be non-empty
+        (the caller must enure that's possible).
+        """
         assert not is_tracing()
         with ResumedTracing():
-            if not values:
-                raise IgnoreAttempt
+            has_values = len(values) > 0
+        if isinstance(values, CrossHairValue):
+            space = context_statespace()
+            assert space.is_possible(has_values)
+            space.add(has_values)
+        else:
+            assert has_values
         self.values = values
         self.idx = 0
 
@@ -2695,6 +2710,7 @@ class SymbolicCallable:
         if idx >= len(values):
             return values[-1]
         else:
+            self.idx += 1
             return values[idx]
 
     def __bool__(self):
@@ -3406,6 +3422,26 @@ class AnySymbolicStr(AbcString):
             return "0" * fill_length + self
 
 
+def _unfindable_range(start: Optional[int], end: Optional[int], mylen: int) -> bool:
+    """
+    Emulates some preliminary checks that CPython makes before searching
+    for substrings within some bounds. (in e.g. str.find, str.startswith, etc)
+    """
+    if start is None or start == 0 or start <= -mylen:
+        return False
+
+    # At this point, we know that `start` is defined and points to an index after 0
+    if end is None or end >= mylen:
+        return start > mylen
+
+    # At this point, we know that `end` is defined and points to an index before the end of the string
+    if start < 0:
+        start += mylen
+    if end < 0:
+        end += mylen
+    return end < start
+
+
 class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
     """
     A symbolic string that lazily generates SymbolicInt-based characters as needed.
@@ -3444,10 +3480,8 @@ class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
             codepoints = tuple(self._codepoints)
         return "".join(chr(realize(x)) for x in codepoints)
 
-    # This is normally an AtomicSymbolicValue method, but sometimes it's used in a
-    # duck-typing way.
     @classmethod
-    def _smt_promote_literal(cls, val: object) -> Optional[z3.SortRef]:
+    def _ch_create_from_literal(cls, val: object) -> Optional[CrossHairValue]:
         if isinstance(val, str):
             return LazyIntSymbolicStr(list(map(ord, val)))
         return None
@@ -3481,6 +3515,10 @@ class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
         with NoTracing():
             if not isinstance(i, (Integral, slice)):
                 raise TypeError(type(i))
+            # This could/should? be symbolic by naming all the possibilities.
+            # Note the slice case still must realize the return length.
+            # Especially because we no longer explore realization trees except
+            # as a last resort.
             i = deep_realize(i)
             with ResumedTracing():
                 newcontents = self._codepoints[i]
@@ -3561,11 +3599,15 @@ class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
             return any(self.endswith(s, start, end) for s in substr)
         if not isinstance(substr, str):
             raise TypeError
+        substrlen = len(substr)
         if start is None and end is None:
             matchable = self
         else:
             matchable = self[start:end]
-        return matchable[-len(substr) :] == substr
+        if substrlen == 0:
+            return not _unfindable_range(start, end, len(self))
+        else:
+            return matchable[-substrlen:] == substr
 
     def startswith(self, substr, start=None, end=None):
         if isinstance(substr, tuple):
@@ -3575,6 +3617,10 @@ class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
         if start is None and end is None:
             matchable = self
         else:
+            # Wacky special case: the empty string is findable off the left
+            # side but not the right!
+            if _unfindable_range(start, end, len(self)):
+                return False
             matchable = self[start:end]
         return matchable[: len(substr)] == substr
 
@@ -3615,7 +3661,7 @@ class LazyIntSymbolicStr(AnySymbolicStr, CrossHairValue):
             end += mylen
         matchstr = self[start:end] if start != 0 or end is not mylen else self
         if len(substr) == 0:
-            # Add oddity of CPython. We can find the empty string when over-slicing
+            # An oddity of CPython. We can find the empty string when over-slicing
             # off the left side of the string, but not off the right:
             # ''.find('', 3, 4) == -1
             # ''.find('', -4, -3) == 0
@@ -4790,14 +4836,17 @@ def _str_format_map(self, map) -> Union[AnySymbolicStr, str]:
 
 
 def _str_startswith(self, substr, start=None, end=None) -> bool:
-    if not isinstance(self, str):
-        raise TypeError
     with NoTracing():
+        if isinstance(self, LazyIntSymbolicStr):
+            with ResumedTracing():
+                return self.startswith(substr, start, end)
+        elif not isinstance(self, str):
+            raise TypeError
         # Handle native values with native implementation:
         if type(substr) is str:
             return self.startswith(substr, start, end)
         if type(substr) is tuple:
-            if all(type(i) is str for i in substr):
+            if all(type(s) is str for s in substr):
                 return self.startswith(substr, start, end)
         symbolic_self = LazyIntSymbolicStr([ord(c) for c in self])
     return symbolic_self.startswith(substr, start, end)

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/builtinslib_ch_test.py

@@ -606,9 +606,14 @@ def check_str_endswith(
     string: str, suffix: str, start: Optional[int], end: Optional[int]
 ) -> ResultComparison:
     """post: _"""
+    # crosshair: max_uninteresting_iterations=100
+
+    for i in (len(string), len(suffix), start, end):
+        if i is not None and abs(i) >= 1:
+            pass
+
     return compare_results(
-        lambda s, *a: s.endswith(*a),
-        string,
+        lambda s, *a, **kw: s.endswith(*a, **kw), string, suffix, start, end
     )
 
 
@@ -825,6 +830,11 @@ def check_str_startswith(
     end: Optional[int],
 ) -> ResultComparison:
     """post: _"""
+    # crosshair: max_uninteresting_iterations=100
+
+    for i in (len(string), len(prefix), start, end):
+        if i is not None and abs(i) >= 1:
+            pass
     return compare_results(
         lambda s, *a, **kw: s.startswith(*a, **kw), string, prefix, start, end
     )

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/builtinslib_test.py

@@ -939,6 +939,31 @@ def test_str_replace_method() -> None:
     check_states(f, POST_FAIL)
 
 
+def test_str_startswith(space) -> None:
+    symbolic_char = proxy_for_type(str, "x")
+    symbolic_empty = proxy_for_type(str, "y")
+    with ResumedTracing():
+        space.add(len(symbolic_char) == 1)
+        space.add(len(symbolic_empty) == 0)
+        assert symbolic_char.startswith(symbolic_empty)
+        assert symbolic_char.startswith(symbolic_char)
+        assert symbolic_char.startswith(("foo", symbolic_empty))
+        assert not symbolic_char.startswith(("foo", "bar"))
+        assert symbolic_char.startswith(("", "bar"))
+        assert symbolic_char.startswith("")
+        assert symbolic_char.startswith(symbolic_empty, 1)
+        assert symbolic_char.startswith(symbolic_empty, 1, 1)
+        assert str.startswith(symbolic_char, symbolic_empty)
+        assert "foo".startswith(symbolic_empty)
+        assert not "".startswith(symbolic_char)
+
+        # Yes, the empty string is findable off the left side but not the right
+        assert "x".startswith("", -10, -9)
+        assert symbolic_char.startswith(symbolic_empty, -10, -9)
+        assert not "x".startswith("", 9, 10)
+        assert not symbolic_char.startswith(symbolic_empty, 9, 10)
+
+
 @pytest.mark.demo
 def test_str_index_method() -> None:
     def f(a: str) -> int:
@@ -3134,6 +3159,17 @@ def test_callable_as_bool() -> None:
     check_states(f, CONFIRMED)
 
 
+def test_callable_can_return_different_values(space) -> None:
+    fn = proxy_for_type(Callable[[], int], "fn")
+    with ResumedTracing():
+        first_return = fn()
+        second_return = fn()
+        returns_are_equal = first_return == second_return
+        returns_are_not_equal = first_return != second_return
+    assert space.is_possible(returns_are_equal)
+    assert space.is_possible(returns_are_not_equal)
+
+
 @pytest.mark.smoke
 def test_callable_repr() -> None:
     def f(f1: Callable[[int], int]) -> int:

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/collectionslib_test.py

@@ -3,7 +3,7 @@ import sys
 from collections import Counter, defaultdict, deque, namedtuple
 from copy import deepcopy
 from inspect import Parameter, Signature
-from typing import Counter, DefaultDict, Deque, NamedTuple, Tuple
+from typing import Callable, Counter, DefaultDict, Deque, Dict, NamedTuple, Tuple
 
 import pytest
 
@@ -14,7 +14,7 @@ from crosshair.core import (
     realize,
     standalone_statespace,
 )
-from crosshair.libimpl.collectionslib import ListBasedDeque
+from crosshair.libimpl.collectionslib import ListBasedDeque, PureDefaultDict
 from crosshair.statespace import CANNOT_CONFIRM, CONFIRMED, POST_FAIL, MessageType
 from crosshair.test_util import check_states
 from crosshair.tracers import NoTracing, ResumedTracing
@@ -246,10 +246,10 @@ def test_defaultdict_default_fail(test_list) -> None:
 
 
 def test_defaultdict_default_ok(test_list) -> None:
-    def f(a: DefaultDict[int, int], k1: int, k2: int) -> DefaultDict[int, int]:
+    def f(a: DefaultDict[int, int], k: int) -> DefaultDict[int, int]:
         """
         pre: len(a) == 0 and a.default_factory is not None
-        post: _[k1] == _[k2]
+        post: _[k] == _[k]
         """
         return a
 

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/functoolslib.py

@@ -1,4 +1,4 @@
-from functools import _lru_cache_wrapper, partial, reduce
+from functools import _lru_cache_wrapper, partial, reduce, update_wrapper, wraps
 
 from crosshair.core import register_patch
 
@@ -7,7 +7,13 @@ from crosshair.core import register_patch
 
 def _partial(func, *a1, **kw1):
     if callable(func):
-        return partial(lambda *a2, **kw2: func(*a2, **kw2), *a1, **kw1)
+        # We make a do-nothing wrapper to ensure that the tracer has a crack
+        # at this function when it is called.
+        def wrapper(*a2, **kw2):
+            return func(*a2, **kw2)
+
+        update_wrapper(wrapper, func)
+        return partial(wrapper, *a1, **kw1)
     else:
         raise TypeError
 

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/libimpl/functoolslib_test.py

@@ -1,20 +1,36 @@
 import functools
+import inspect
 
 from crosshair.core import proxy_for_type, standalone_statespace
 from crosshair.libimpl.builtinslib import LazyIntSymbolicStr
-from crosshair.tracers import NoTracing
+from crosshair.tracers import NoTracing, ResumedTracing
 
 
-def test_partial():
-    with standalone_statespace as space:
-        with NoTracing():
-            abc = LazyIntSymbolicStr(list(map(ord, "abc")))
-            xyz = LazyIntSymbolicStr(list(map(ord, "xyz")))
+def test_partial(space):
+    abc = LazyIntSymbolicStr(list(map(ord, "abc")))
+    xyz = LazyIntSymbolicStr(list(map(ord, "xyz")))
+    with ResumedTracing():
         joiner = functools.partial(str.join, ",")
         ret = joiner([abc, xyz])
         assert ret == "abc,xyz"
 
 
+def test_partial_is_interceptable(space):
+    x = proxy_for_type(str, "x")
+    y = proxy_for_type(str, "y")
+    with ResumedTracing():
+        joiner = functools.partial(str.startswith, x)
+        # Ensure we don't explode
+        list(map(joiner, ["foo", y]))
+
+
+def test_partial_arg_is_inspectable(space):
+    with ResumedTracing():
+        joiner = functools.partial(str.join, ",")
+        assert isinstance(joiner, functools.partial)
+        assert inspect.getdoc(joiner.func) == inspect.getdoc(str.join)
+
+
 def test_reduce():
     with standalone_statespace as space:
         with NoTracing():

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/opcode_intercept.py

@@ -5,7 +5,9 @@ from collections import defaultdict
 from collections.abc import MutableMapping, Set
 from sys import version_info
 from types import CodeType, FrameType
-from typing import Any, Callable, Iterable, Mapping, Tuple, Union
+from typing import Any, Callable, Iterable, List, Mapping, Tuple, Union
+
+from z3 import ExprRef
 
 from crosshair.core import (
     ATOMIC_IMMUTABLE_TYPES,
@@ -83,13 +85,6 @@ class MultiSubscriptableContainer:
             if isinstance(container, Mapping):
                 kv_pairs: Iterable[Tuple[Any, Any]] = container.items()
             else:
-                in_bounds = space.smt_fork(
-                    z3Or(-len(container) <= key.var, key.var < len(container)),
-                    desc=f"index_in_bounds",
-                    probability_true=0.9,
-                )
-                if not in_bounds:
-                    raise IndexError
                 kv_pairs = enumerate(container)
 
             values_by_type = defaultdict(list)
@@ -118,7 +113,7 @@ class MultiSubscriptableContainer:
                 keys_by_value_id[id(cur_value)].append(cur_key)
             for value_type, cur_pairs in values_by_type.items():
                 hypothetical_result = symbolic_for_pytype(value_type)(
-                    "item_at_" + space.uniq(), value_type
+                    "item_" + space.uniq(), value_type
                 )
                 with ResumedTracing():
                     condition_pairs = []
@@ -139,20 +134,17 @@ class MultiSubscriptableContainer:
                         space.add(any([all(pair) for pair in condition_pairs]))
                         return hypothetical_result
 
-            for (value_id, value), probability_true in with_uniform_probabilities(
-                values_by_id.items()
-            ):
+            exprs_and_values: List[Tuple[ExprRef, object]] = []
+            for value_id, value in values_by_id.items():
                 keys_for_value = keys_by_value_id[value_id]
                 with ResumedTracing():
                     is_match = any([key == k for k in keys_for_value])
                 if isinstance(is_match, SymbolicBool):
-                    if space.smt_fork(
-                        is_match.var,
-                        probability_true=probability_true,
-                    ):
-                        return value
+                    exprs_and_values.append((is_match.var, value))
                 elif is_match:
                     return value
+            if exprs_and_values:
+                return space.smt_fanout(exprs_and_values, desc="multi_subscript")
 
             if type(container) is dict:
                 raise KeyError  # ( f"Key {key} not found in dict")

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/path_cover.py

@@ -133,7 +133,11 @@ def path_cover(
     selected: List[PathSummary] = []
     while paths:
         next_best = max(
-            paths, key=lambda p: len(p.coverage.offsets_covered - opcodes_found)
+            paths,
+            key=lambda p: (
+                len(p.coverage.offsets_covered - opcodes_found),  # high coverage
+                -len(p.formatted_args),  # with small input size
+            ),
         )
         cur_offsets = next_best.coverage.offsets_covered
         if coverage_type == CoverageType.OPCODE:

{crosshair_tool-0.0.95 → crosshair_tool-0.0.96}/crosshair/pathing_oracle.py

@@ -2,7 +2,7 @@ import math
 from collections import defaultdict
 from typing import Counter, Dict, List, Optional, Sequence, Tuple
 
-from z3 import ExprRef  # type: ignore
+from z3 import ExprRef
 
 from crosshair.statespace import (
     AbstractPathingOracle,
@@ -11,9 +11,11 @@ from crosshair.statespace import (
     NodeLike,
     RootNode,
     SearchTreeNode,
+    StateSpace,
     WorstResultNode,
 )
 from crosshair.util import CrossHairInternal, debug, in_debug
+from crosshair.z3util import z3And, z3Not, z3Or
 
 CodeLoc = Tuple[str, ...]
 
@@ -60,7 +62,8 @@ class CoveragePathingOracle(AbstractPathingOracle):
     # (even just a 10% change could be much larger than it would be otherwise)
     _delta_probabilities = {-1: 0.1, 0: 0.25, 1: 0.9}
 
-    def pre_path_hook(self, root: RootNode) -> None:
+    def pre_path_hook(self, space: StateSpace) -> None:
+        root = space._root
         visits = self.visits
         _delta_probabilities = self._delta_probabilities
 
@@ -213,16 +216,50 @@ class PreferNegativeOracle(AbstractPathingOracle):
         return 0.25
 
 
+class ConstrainedOracle(AbstractPathingOracle):
+    """
+    A pathing oracle that prefers to take a path that satisfies
+    explicitly provided constraints.
+    """
+
+    def __init__(self, inner_oracle: AbstractPathingOracle):
+        self.inner_oracle = inner_oracle
+        self.exprs: List[ExprRef] = []
+
+    def prefer(self, expr: ExprRef):
+        self.exprs.append(expr)
+
+    def pre_path_hook(self, space: StateSpace) -> None:
+        self.space = space
+        self.exprs = []
+        self.inner_oracle.pre_path_hook(space)
+
+    def post_path_hook(self, path: Sequence["SearchTreeNode"]) -> None:
+        self.inner_oracle.post_path_hook(path)
+
+    def decide(
+        self, root, node: "WorstResultNode", engine_probability: Optional[float]
+    ) -> float:
+        # We always run the inner oracle in case it's tracking something about the path.
+        default_probability = self.inner_oracle.decide(root, node, engine_probability)
+        if not self.space.is_possible(z3And(*[node.expr, *self.exprs])):
+            return 0.0
+        elif not self.space.is_possible(z3And(*[z3Not(node.expr), *self.exprs])):
+            return 1.0
+        else:
+            return default_probability
+
+
 class RotatingOracle(AbstractPathingOracle):
     def __init__(self, oracles: List[AbstractPathingOracle]):
         self.oracles = oracles
         self.index = -1
 
-    def pre_path_hook(self, root: "RootNode") -> None:
+    def pre_path_hook(self, space: StateSpace) -> None:
         oracles = self.oracles
         self.index = (self.index + 1) % len(oracles)
         for oracle in oracles:
-            oracle.pre_path_hook(root)
+            oracle.pre_path_hook(space)
 
     def post_path_hook(self, path: Sequence["SearchTreeNode"]) -> None:
         for oracle in self.oracles:

crosshair_tool-0.0.96/crosshair/pathing_oracle_test.py

@@ -0,0 +1,21 @@
+import random
+
+import z3
+
+from crosshair.pathing_oracle import ConstrainedOracle, PreferNegativeOracle
+from crosshair.statespace import RootNode, SimpleStateSpace, WorstResultNode
+
+
+def test_constrained_oracle():
+    oracle = ConstrainedOracle(PreferNegativeOracle())
+    x = z3.Int("x")
+    root = RootNode()
+    space = SimpleStateSpace()
+    oracle.pre_path_hook(space)
+    oracle.prefer(x >= 7)
+    rand = random.Random()
+    assert oracle.decide(root, WorstResultNode(rand, x < 7, space.solver), None) == 0.0
+    assert oracle.decide(root, WorstResultNode(rand, x >= 3, space.solver), None) == 1.0
+    assert (
+        oracle.decide(root, WorstResultNode(rand, x == 7, space.solver), None) == 0.25
+    )